I’m currently presenting the BCI’s 5 day Good Practice Guidelines course, and for the second time in 3 months have had one of the delegates express their concerns about the difficulties involved in keeping large numbers of BCPs up to date, and that a new approach to Business Continuity is required.
The concerns are twofold. Firstly, the administration and bureaucracy involved in keeping track of, updating, and distributing large numbers of BCPs to too time consuming and costly, but more importantly, the BCPs are not being kept up to date and are therefore not worth the paper that they’re written on. If the BCPs are not up to date, there’s no point in using them, so why don’t we all admit that the current approach isn’t working and look for another way that will work?
This “other way” might involve having a small number of BCPs addressing the recovery of an organization’s core infrastructure, with local managers being assumed to know what they need to do to recover their operations in the context of having this infrastructure available, and not having to write detailed BCPs that are never kept up to date.